GDPR Compliance

Last Updated: September 29, 2026

Cedar-spark is committed to protecting the privacy and personal data of all individuals, including those in the European Union. This page outlines how we comply with the General Data Protection Regulation (GDPR).

Legal Basis for Processing

We process personal data only when we have a legal basis to do so:

• Consent: When you provide explicit consent for us to process your personal data
• Contract: When processing is necessary to fulfill a contract or service agreement with you
• Legal Obligation: When we must process data to comply with legal requirements
• Legitimate Interest: When processing is necessary for our legitimate business interests, balanced against your rights

Your GDPR Rights

Under GDPR, you have the following rights regarding your personal data:

Right to Access

You have the right to request copies of your personal data. We may charge a reasonable fee for additional copies beyond the first request.

Right to Rectification

You have the right to request correction of any inaccurate or incomplete personal data we hold about you.

Right to Erasure

You have the right to request deletion of your personal data under certain conditions, including when the data is no longer necessary for its original purpose.

Right to Restrict Processing

You have the right to request that we restrict processing of your personal data under specific circumstances.

Right to Data Portability

You have the right to request transfer of your data to another organization or directly to you in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing of your personal data when we rely on legitimate interest as the legal basis.

Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significant effects.

How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex or we receive multiple requests, we may extend this period by two additional months, and we will inform you of such extension.

Data Protection Officer

For questions specifically related to data protection and GDPR compliance, you may contact our data protection contact at [email protected].

Data Security Measures

We implement appropriate technical and organizational security measures to protect your personal data:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting who can view personal data
• Staff training on data protection practices
• Incident response procedures for data breaches

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach poses a high risk, we will also notify affected individuals without undue delay.

International Data Transfers

When we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions confirming adequate protection in the destination country
• Other legally recognized transfer mechanisms

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specific retention periods vary depending on the type of data and purpose of processing.

Third-Party Processing

When we engage third-party service providers to process personal data on our behalf, we ensure they:

• Process data only according to our documented instructions
• Implement appropriate security measures
• Maintain confidentiality of personal data
• Comply with GDPR requirements

Complaints

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged infringement occurred.

Updates to This Policy

We may update this GDPR compliance statement as regulations evolve or our practices change. We will notify you of material changes through our website or direct communication.

Contact Information

For any questions about our GDPR compliance or to exercise your rights:

Email: [email protected]
Location: Toronto, Ontario, Canada